To add which user and what he/she was doing exactly to the log files, raise the log level for the event “EventContext”, e.g. “change evtloglvl EventContext=log_level for comp component_name“, remove the “comp” keyword if you want it for all components.